imgSrcSanitizationWhitelist seems too broad

[sirdarckcat]

in
https://github.com/angular/angular.js/blob/master/src/ng/sanitizeUri.js

imgSrcSanitizationWhitelist = /^\s*(https?|ftp|file|blob):|data:image\//;

probably should be:

imgSrcSanitizationWhitelist = /^\s*(https?|ftp|file|blob):|^\s*data:image\//;

otherwise:

javascript:alert(1)//data:image/

passes as valid.

[petebacondarwin]

Or perhaps:

/^\s*((https?|ftp|file|blob):|data:image\/)/

[petebacondarwin]

@btford - do you have any comment on this? I could take this and knock up a PR if there is not something more complex to worry about here.

[sirdarckcat]

oh, also, it would be nice to add chrome-extension: and chrome-extension-resource: to the list of schemes